What is the CVSS score of EUVD-2026-16305?

EUVD-2026-16305 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16305?

Organizations using Daylight Studio FuelCMS v1.5.2 face notable risk from CVE-2026-30463, a SQL injection vulnerability rated CVSS 7.7.

How to fix or mitigate EUVD-2026-16305?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP EUVD-2026-16305

| CVE-2026-30463 HIGH

SQL Injection (CWE-89)

2026-03-26 mitre

PHP SQLi N A

7.7

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 19:16 euvd

EUVD-2026-16305

Analysis Generated

Mar 26, 2026 - 19:16 vuln.today

CVE Published

Mar 26, 2026 - 00:00 nvd

HIGH 7.7

DescriptionCVE.org

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

AnalysisAI

SQL injection in Daylight Studio FuelCMS v1.5.2 Login.php component allows remote attackers to execute arbitrary SQL queries against the application database. The vulnerability affects the authentication mechanism, potentially enabling account enumeration, credential bypass, or unauthorized data extraction. No public exploit code or active exploitation has been confirmed at this time, though the specific attack vector suggests direct manipulation of login form parameters.

Technical ContextAI

FuelCMS is a lightweight PHP-based content management system. The vulnerability resides in the Login.php controller component, which processes user authentication requests. The root cause is classified as SQL injection (SQLi), indicating insufficient input sanitization or parameterized query usage in SQL statement construction. Authentication credentials or related parameters passed to the login controller are not properly escaped or bound, allowing attackers to inject SQL metacharacters and alter query logic. PHP's interaction with the database layer (likely MySQL or similar relational backend) permits this class of attack when raw string concatenation is used in query building rather than prepared statements.

RemediationAI

Upgrade Daylight Studio FuelCMS to the latest stable release available from http://fuelcms.com or http://daylight.com. Consult vendor release notes to confirm SQL injection remediation in the target version. If immediate patching is not feasible, implement compensating controls: (1) enforce strong input validation on all login form parameters using whitelisting of expected character sets; (2) apply a Web Application Firewall (WAF) rule set blocking common SQL injection patterns (e.g., single quotes, UNION, OR 1=1) in POST data; (3) restrict database user accounts to least-privilege permissions, limiting the damage scope if injection succeeds; (4) enforce HTTPS/TLS for all login requests to prevent credential interception; (5) monitor login controller logs for anomalous SQL error messages or failed authentication spikes. For long-term security, migrate to an actively maintained CMS platform if FuelCMS v1.5.2 is no longer receiving vendor updates.